594 reports
Microsoft Threat Intelligence reports that North Korean clusters including Jasper Sleet, Coral Sleet, Sapphire Sleet, and Emerald Sleet are using AI as an operational accelerator across reconnaissance, persona building, infrastructure setup, and social en…
A fake LinkedIn recruiter posing as a 0G Labs representative targeted a crypto/Web3 CEO with a technical assessment that required cloning a Bitbucket repository and opening it in VS Code or Cursor. The repository hid three independent execution paths: a V…
eSentire TRU observed DEV#POPPER on an Energy, Utilities, and Waste customer machine in February 2026 and attributes the activity with high confidence to a North Korean state-sponsored APT based on shared TTPs with related campaigns. The intrusion began w…
Quetzal Team analyzes a Famous Chollima campaign that targets cryptocurrency-themed job or training lures with ClickFix-style social engineering. The infection chain starts with a faux LinkedIn invite to a crypto training site, then a fake webcam driver i…
Cloudflare's 2026 threat report describes a shift toward high-trust exploitation, where adversaries favor stolen tokens, legitimate cloud services, SaaS integrations, and automation over bespoke exploits. The DPRK-relevant sections highlight North Korea's…
RUSI assesses the UK-Republic of Korea Strategic Cyber Partnership as a vehicle for improving joint cyber resilience, deterrence, information sharing, and technology cooperation. The paper recommends expanding government, academic, research, and commercia…
Moonlock Lab tracks a campaign targeting cryptocurrency and Web3 professionals through LinkedIn outreach, fabricated venture capital firms, and fake Zoom or Google Meet links. The attack flow uses recruiter or investor personas tied to fronts such as Soli…
Hudson Rock analyzes a suspected DPRK IT worker machine infected with LummaC2, using the stolen telemetry to expose an Indonesian proxy node tied to fake IT-worker and fraud activity. The investigation began with Funnull CDN credentials in the log, then f…
Ctrl-Alt-Intel observed suspected DPRK-linked intrusions against cryptocurrency organizations, including staking platforms, exchange software providers, and exchange cloud tenants. The activity combined React2Shell scanning and exploitation with separate …
Know Your Adversary describes APT37 activity tracked as Squid Werewolf using the RESTLEAF implant with abuse of Zoho WorkDrive, a legitimate cloud file-management and collaboration platform. The excerpt focuses on proactive hunting for communications to w…
Red Asgard examined an active Lazarus Group operator VPS tied to the Contagious Interview campaign, which targets cryptocurrency and Web3 developers through fake job interviews, fabricated company identities, and malicious repositories. The Windows Server…
Socket uncovered 26 malicious npm packages tied to North Korea’s Contagious Interview activity and assessed the tradecraft as consistent with FAMOUS CHOLLIMA. The packages were typosquats of widely used developer libraries and executed install scripts tha…
SOCRadar profiles Andariel as a North Korea-linked threat group operating under the Reconnaissance General Bureau and widely assessed as a Lazarus sub-cluster. The group targets defense, aerospace, nuclear engineering, healthcare, financial, software, and…
ENKI attributes GitHub-hosted malware abusing Visual Studio Code automation features to the DPRK-nexus Contagious Interview campaign targeting developers. Actors posed as recruiters, Web3 developers, and fictitious companies, then embedded OS-specific dow…
ENKI found a Contagious Interview campaign using GitHub repositories and VSCode task automation to infect developers with Beavertail, InvisibleFerret, and OtterCookie-related tooling. The operators posed as recruiters, developers, and fictitious or lookal…